Security & Data Handling

Access you control.
Data that stays yours.

What your security team needs to know before giving an outside team access: who can reach your systems, how your data is handled, how software is built, and what happens when something goes wrong.

Send us your questionnaire Capabilities presentation (PDF)

01 · People

The people who can reach your systems are few, known to you, and based in the United States.

U.S.-based teamEveryone who works on your systems or data is based in the United States. We do not offshore or subcontract delivery without your written approval.
Named access onlyYou receive the names of everyone on the engagement. Nobody outside that list is given access, and the list is updated when it changes.
ConfidentialityEvery team member is bound by confidentiality obligations, and we sign your non-disclosure agreement before any discovery work.
Prompt removalWhen someone leaves the engagement, their access to your systems is removed the same business day, and you are told.

02 · Access

Access is granted by you, limited to the job, and revocable at any time.

Named accounts with MFAEach person signs in with their own account protected by multi-factor authentication. No shared logins, and no access by a vendor-wide account.
Least privilegeAccess matches the task. Administrative rights sit on separate privileged accounts used only for administration.
Credentials in a vaultPasswords and keys live in an encrypted password vault with access logging, never in email, chat or documents.
Logged changesAdministrative actions are made through accounts and tools that keep an audit trail you can review.

03 · Data handling

Your data stays in your systems wherever possible, and leaves only in the ways we agree.

Your tenants, your storageWe work inside the cloud tenants, databases and repositories you own. Copies outside them are made only when the work requires it, and are deleted afterwards.
EncryptionData is encrypted in transit and at rest, using the platform's managed encryption and keys, or yours where you require it.
No live data in developmentDevelopment and test environments use synthetic or masked data unless you approve otherwise in writing.
Return and deletionAt the end of an engagement, data is returned or deleted as you direct, with written confirmation.

04 · Secure development

Security is part of how software is written, reviewed and released.

Reviewed changesEvery code change is reviewed before it is merged. Nothing reaches production straight from someone's laptop.
Dependency and secret scanningThird-party packages are checked for known vulnerabilities, and repositories are scanned so credentials are never committed.
Separate environmentsDevelopment, staging and production are separate, with separate credentials and access.
Common weaknesses addressedInput validation, authorization checks and output encoding are built in, with the OWASP Top 10 as the baseline.

05 · Incidents

If something goes wrong, you hear about it from us first, and recovery is coordinated.

MonitoringManaged endpoints and servers are monitored around the clock, with alerts triaged by security analysts.
Prompt notificationSuspected incidents affecting your systems or data are reported to your named contacts without undue delay, within the time set in your agreement.
Coordinated responseContainment, investigation and recovery are run with your IT team, your insurer and any incident-response firm they appoint.
Written follow-upEvery significant incident ends with a written summary: what happened, what was affected, and what changes to prevent it.

06 · Compliance support

We work to the framework your organization is held to, and document it the way your auditors expect.

FrameworksControls are mapped to NIST CSF, NIST SP 800-171 and CMMC, HIPAA, CJIS or PCI DSS, depending on what applies to you.
Regulated dataEngagements involving protected health information or criminal justice information follow the agreements and controls those rules require.
Security questionnairesWe complete your vendor security questionnaire (SIG, CAIQ, HECVAT or your own) and provide supporting evidence.
Your policies applyYour acceptable-use, change and data policies apply to our team as they do to your staff.
SOC 2 audited platformYour devices are monitored, patched and supported through NinjaOne, a management platform independently audited under SOC 2.

The rest of how we operate.

Security Review

Put us through
your vendor review.

Send your security questionnaire, data-processing terms or policies. We answer each control and attach the evidence.

Start a security review